aws-guardduty-detect-securityhubremediate/cft/aws-guarddutydetect-securityhubremediate-v1.yml [503:578]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  EC2VPC1InstanceProfile:
    DependsOn:
      - EC2VPC1Role
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref EC2VPC1Role 


  EC2VPC1Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
      Policies:
        -
          PolicyName: GuardDutyPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action:
                  - guardduty:GetDetector
                  - guardduty:ListDetectors
                  - guardduty:CreateThreatIntelSet
                  - guardduty:UpdateThreatIntelSet
                Resource: '*'
              -
                Effect: Allow
                Action:
                  - ssm:PutParameter
                  - ssm:DescribeParameters
                  - ssm:GetParameters
                  - ssm:DeleteParameter
                Resource: '*'
              -
                Effect: Allow
                Action:
                  - iam:*
                Resource: '*'
              -
                Effect: Allow
                Action:
                  - dynamodb:*
                Resource: '*'
              -
                Effect: Allow
                Action: s3:*
                Resource: '*'
              -
                Effect: Allow
                Action:
                  - iam:PutRolePolicy
                Resource:
                  Fn::Join:
                    - ':'
                    - ["arn:aws:iam:",!Ref "AWS::AccountId", "role/aws-service-role/guardduty.amazonaws.com/*"]


  SGEC2VPC1:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupDescription: !Join ["", ["Stack", "-", !Ref "AWS::StackId", "-", "VPC1"]]
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



aws-guardduty-detect-securityhubremediate/cft/aws-guarddutydetect-securityhubremediate.yml [601:675]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  EC2VPC1InstanceProfile:
    DependsOn:
      - EC2VPC1Role
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles:
        - !Ref EC2VPC1Role 

  EC2VPC1Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
      Policies:
        -
          PolicyName: GuardDutyPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              -
                Effect: Allow
                Action:
                  - guardduty:GetDetector
                  - guardduty:ListDetectors
                  - guardduty:CreateThreatIntelSet
                  - guardduty:UpdateThreatIntelSet
                Resource: '*'
              -
                Effect: Allow
                Action:
                  - ssm:PutParameter
                  - ssm:DescribeParameters
                  - ssm:GetParameters
                  - ssm:DeleteParameter
                Resource: '*'
              -
                Effect: Allow
                Action:
                  - iam:*
                Resource: '*'
              -
                Effect: Allow
                Action:
                  - dynamodb:*
                Resource: '*'
              -
                Effect: Allow
                Action: s3:*
                Resource: '*'
              -
                Effect: Allow
                Action:
                  - iam:PutRolePolicy
                Resource:
                  Fn::Join:
                    - ':'
                    - ["arn:aws:iam:",!Ref "AWS::AccountId", "role/aws-service-role/guardduty.amazonaws.com/*"]


  SGEC2VPC1:
    Type: "AWS::EC2::SecurityGroup"
    Properties:
      GroupDescription: !Join ["", ["Stack", "-", !Ref "AWS::StackId", "-", "VPC1"]]
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



